We care about security.
If you have any questions, or encounter any issues, please contact us.
Product security is of very high importance at ITculate. ITculate uses a software development lifecycle in line with general Agile principles. When security effort is applied throughout the Agile release cycle, security oriented software defects are able to be discovered and addressed more rapidly than in longer release cycle development methodologies. Software patches are released as part of our continuous integration process.
ITculate agile development process and the use of continuous integration concepts allows for rapid deployment of fixes. In this way we are able to respond rapidly to both functional and security issues.
The ITculate production infrastructure is hosted in Amazon Web Services (AWS). Physical and environmental security related controls for ITculate production servers, which includes buildings, locks or keys used on doors are managed by AWS. “Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors.”
All data transmitted between ITculate and ITculate users is protected using Secured Socket Layer (SSL) and Hyper Text Transfer Protocol Secured (HTTPS). If encrypted communication is interrupted the ITculate application is inaccessible. ITculate does not “fail open.” ITculate is careful not to log sensitive values in clear text.
Protection of Data at Rest
All data stores are contained in a highly secured environment that requires 4 factor authentication. While encrypted in transport, customer data at ITculate is currently not encrypted at rest.
Customer Data Storage Location
ITculate service data currently resides in the United States of America and primarily in the state of Virginia.
For Service users, we will retain your personally identifying information (PII) for as long as your account is active or as needed to provide you access and use rights with respect to the Service (which may include a limited 14-90 day tail period to, for example, allow for an orderly wind-down). Generally speaking, “full resolution” electronic information transmitted or received by you in relation to your use of the Service (which may include PII) will be retained for a rolling 15-month look-back period, after which such information may be aggregated on the basis of a one-minute resolution for the duration of the service period and any tail period. In addition, we may retain and use your information as necessary to comply with our legal obligations, resolve disputes and enforce our agreements.
Gathering of Personally Identifiable Information (PII)
Certain visitors to the Website and Service choose to interact with ITculate in ways that require ITculate to gather personally identifiable information (PII). The amount and type of information that ITculate gathers depends on the nature of the interaction. For example, when signing up for a trial of the Service, we may ask a user to provide the user’s name and the name of the user’s company, as well as an email address and telephone number where we may contact the user and/or another representative of the user’s company. Each user is also expected to provide a username and password that, along with other information, we use to create and administer accounts. In each case, ITculate collects such information only insofar as is necessary or appropriate to fulfill the purpose of the visitor’s interaction with ITculate.
Customer Data Access
A limited number of ITculate employees have access to customer data via access controlled and logged mechanisms. Employees engaged in customer support access a support application similar in structure to the ITculate end user web application that allows them to access customer data. Access to this system requires authenticating to our central identity provider and using two factor authentication. Technical operations employees have access to the raw service data storage. This access requires using a specific physical location to initiate communication from, authentication via a certificate key and two factor authentication. All other employees are prohibited from accessing customer data.
The collector is a small packaged Python application that runs on your environment. It can be configured to collect data from different devices in your environment and securely send it to ITculate for analysis. This is the only piece that needs to be installed on the environment. More information about the collector can be found in the following overview, and data flow documentation. The data being collected includes configuration, performance metrics of different elements in the environment and log data. The collector never collects, sends (or even have access to) the actual data.
To be able to collect data from devices, the collector needs to be granted permission to access the management console of these devices. For example, for AWS, we would need access to the environment via API (but no access to the actual network). We try to minimize the level of permissions we need, and we typically only ask for read-only access. Regardless of permission level, we only issue read-only commands that inspect the environment.
When installed in an AWS environment we recommend starting a small instance and applying an instance role to it (see details here), that is composed or read-only permissions. Using that role the user have complete control over what can be accessed.
If additional devices are being collected (e.g. Cassandra, Oracle, RabbitMQ, NetApp Storage etc.), the user should make sure that the security groups allows the appropriate access. The instance running the collector should be able to access ITculate servers over https.
Version Updates and Patches
The collector component will self update when there is a new version. This is usually acceptable from a security standpoint because the collector access is tightly managed using an IAM role and security groups. It also provides the advantage of quick issue resolution. However, if the self update functionality is still a security concern, please contact ITculate support to discuss available alternatives.
While use of ITculate does not strictly require use of the ITculate agent, many users leverage the agent. The Agent allows you to gather business or application specific metrics (also known as “custom metrics”). The agent is written in Python, and published as an open-source project to allow customers complete access to the code (see bitbuck repository here: https://bitbucket.org/itculate/itculate-agent). The code is provided under MIT license. The collector (agent.py) is responsible for gathering system and application metrics from the machine, buffering and communicating with ITculate HQ over SSL. Our statsd (statsd.py)is responsible for aggregating local metrics sent from your code. Our supervisord is responsible for keeping the process up and running. The agent does not require root privileges.
Our supervisord runs a master process and forks all subprocesses as the user itsdk. The agent configuration resides at /etc/itculate/agent.conf and /etc/supervisor/conf.d/itculate-agent.conf. All configuration must be readable by itsdk. The recommended permissions are 0600. The default installation location of the agent is /opt/itculate-agent (under linux). The log files can be found under /var/log/itculate/ .
All requests to ITculate’s API must be authenticated. Requests that write data require reporting access and require an API key. Requests that read data require full access and also require an application key. These keys act as a bearer tokens allowing access to ITculate service functionality. The standard installation process walks you through providing the required keys so that the agent is provided with the required API keys unique for your account.
Servers in the production environment receive software patches released through periodic update process. Patches that can impact end users will be applied as soon as possible but may necessitate end user notification and scheduling a service window.
Single Sign On (SSO)
End users may log in to ITculate using an Identity Provider, leveraging the “Sign-in with Google” Open ID service. This service will authenticate an individual’s identity and may provide the option to share certain personally identifying information with us such as your name and email address to pre-populate our sign up form.
Security Awareness Mindset
All ITculate personnel operate with a strong security mindset. Every employee at any position is encouraged to understand security in details and constantly self educate on security developments. Security is weaved into technical and non-technical roles; all employees are encouraged to participate in helping secure our customer data and company assets.